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WHAT IS CLAIMED IS: 

1. A method for improving diagnosis of a complex problem, wherein a plurality 
of indicators expected to relate to the problem are correlated over a window of time, the window 
of time comprising a plurality of time slices in each of which a state of each indicator is 
determined, the method comprising: 

determining which indicator or indicators changed state during a first time slice in 
the window and which indicator or indicators did not change state during the first time slice; 

computing a time slice transition factor based upon a number of indicators whose 
state changed and a number of indicators whose state did not change during the first time slice; 
and 

adjusting the correlation of the indicators over the window of time using the time 
slice transition factor. 

2. The method of claim 1, wherein determining state changes in each of the 
indicators comprises determining the state changes of each indicator in each of a plurality of time 
slices in the window. 

3. The method of claim 2, wherein computing a time slice transition factor 
comprises computing a plurality of time slice transition factors, and wherein adjusting the 
correlation of the indicators comprises adjusting the correlation using the plurality of time slice 
transition factors. 

4. The method of claim 1, wherein determining state changes comprises 
comparing the state of each of the indicators in the first time slice with the state of the respective 
indicator in a second time slice preceding the first time slice. 
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5. The method of claim 4, wherein the second time slice immediately precedes 
the first time slice. 

6. The method of claim 1 , wherein indicators have a plurality of possible states 
including a low state and a high state, and wherein determining state changes in the indicators in 

5 the first time slice comprises determining which indicator or indicators changed state from low to 
high and which indicator or indicators changed state from high to low. 

7. The method of claim 6, wherein computing the time slice transition factor 
comprises computing the transition factor further based upon a number of indicators whose state 
changed from low to high and a number of indicators whose state changed from high to low. 

'EO 8. The method of claim 7, wherein computing the time slice transition factor 

IQ 

'eA comprises identifying a maximum among the number of indicators whose state did not change, 

in 

Ip 1 the number of indicators whose state changed fi-om low to high, and the number of indicators 

in 

whose state changed from high to low, and dividing the maximum by the number of indicators, 
^r! 9. The method of claim 1, wherein indicators are correlated based on the states of 

["§5 the indicators in each time slice, and wherein adjusting the correlation comprises applying the 
H time slice transition factor to the correlation for the first time slice. 

10. The method of claim 1, wherein the indicators are grouped into two or more 
groups of indicators, and wherein computing the time slice transition factor comprises computing 
a time slice transition factor for each group based upon the numbers of indicators in each group 

20 whose state changed or did not change during the time slice. 

11. The method of claim 1, wherein determining indicator state changes 
comprises adjusting the first time slice to account for potential delays in determining states of the 
indicators. 

24 Express Mail No. EL7 1 8275755US 

BRMFSl 237890v5 



3882/8 

12. The method of claim 11, wherein adjusting the first time slice to account for 
potential delays comprises: 

determining which indicator, if any, changed state last in time during the first time 

slice; 

determining whether any other indicators changed state during a predefined period 
preceding the time of last indicator state change; and 

considering such other indicators whose state changed during the predefined 
period as having occurred during the first time slice. 

13. The method of claim 1, comprising storing a transition relevance factor in 
association with each indicator representing whether the indicator is relevant, and wherein 
determining state changes comprises determining the changes only for relevant indicators. 

14. In a system for analyzing faults in devices by correlating a plurality of 
indicators over a window of time and generating alarms based upon the correlation, the window 
of time comprising a plurality of time slices in each of which a state of each indicator is probed, a 
method for reducing false alarms comprising: 

determining which of the indicators changed state in similar fashion during a first 
time slice in the window or did not change state during the first time slice; 

computing a time slice transition factor that relates a number of the indicators 
whose state changed in similar fashion or did not change during the first time slice to a total 
number of the indicators; and 

adjusting the correlation of the indicators over the window of time using the time 
slice transition factor. 
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15. A computer readable medium storing program code which, when executed, 
causes a computer to perform a method for reducing false alarms in a system for analyzing 
problems by correlating a plurality of indicators over a window of time and generating alarms 
based upon the correlation, the window of time comprising a plurality of time slices in each of 
5 which a state of each indicator is probed, the method comprising: 

determining which of the indicators changed state in similar fashion during a first 
time slice in the window or did not change state during the first time slice; 

computing a time slice transition factor that relates a number of the indicators 
whose state changed in similar fashion or did not change during the first time slice to a total 

a 

, AO number of the indicators; and 

CO 

1^ adjusting the correlation of the indicators over the window of time using the time 

m 

In 

^ 1 slice transition factor. 

if! 
hi 

.16. The computer readable medium of claim 1 5 wherein the method performed 

C3 

ly by the program comprises determining the state changes of each indicator in each of a plurality 

ru 

f U 5 of time slices in the window. 

Cj 

i""^ 17. The computer readable medium of claim 16 wherein the method performed by 

the program comprises computing a plurality of time slice transition factors and adjusting the 
correlation using the plurality of time slice transition factors. 

18. The computer readable medium of claim 15, wherein indicators have a 

20 plurality of possible states including a low state and a high state, and wherein the method 

performed by the program comprises determining which indicator or indicators changed state 
firom low to high and which indicator or indicators changed state from high to low. 
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19. The computer readable medium of claim 18 wherein the method performed by 
the program comprises computing the transition factor further based upon a number of indicators 
whose state changed from low to high and a number of indicators whose state changed from high 
to low. 

20. The computer readable medium of claim 1 5 wherein the method performed 
by the program comprises computing the time slice transition factor by identifying a maximum 
among the number of indicators whose state did not change, the number of indicators whose state 
changed from low to high, and the number of indicators whose state changed from high to low, 
and dividing the maximum by the number of indicators. 

21. The computer readable medium of claim 15, wherein the indicators are 
grouped into two or more groups of indicators, and wherein the method performed by the 
program comprises computing a time slice transition factor for each group based upon the 
numbers of indicators in each group whose state changed or did not change during the time slice. 

22. The computer readable medium of claim 1 5, wherein a transition relevance 
factor is stored in association with each indicator representing whether the indicator is relevant, 
and wherein the method performed by the program comprises determining state changes only for 
relevant indicators. 

23. A method for correlating a number of indicators in a rules-based correlation 
system, wherein a plurality of indicators expected to relate to a problem are correlated over a 
window of time, the method comprising: 

detecting transitions in each indicator between a first state and a second state, 
which transitions occur during all or part of the window of time; 

counting the number of transitions detected for each indicator; 
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comparing the number of transitions for each indicator to the number of 
transitions counted for the other indicators; and 

correlating transitions of indicators based on the comparison so that indicators 
which are not changing together are less likely to be correlated by a rule employed in the rules- 
based correlation system. 

24. The method of claim 23, wherein detecting and counting transitions are 
performed during a time interval forming a part of the window. 

25. A method for correlating a number of indicators in a rules-based correlation 
system, wherein a plurality of indicators each having multiple possible values and expected to 
relate to a problem are correlated over a window of time, the method comprising: 

dividing the window of time into a plurality of time slices; 

determining a value for each indicator during each of a plurality of the time slices; 

determining a transition state for each indicator during each of the plurality of 
time slices, the transition state representing whether and how the indicator changed state during 
the time slice; and 

correlating the indicators over the window of time based upon the determined 
indicator values and transitions states. 
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